Junglewise Threat Intelligence
Live threat intelligence feed
Updated .
Vulnerabilities as Junglewise tracks them, newest first, with the technologies they affect, how severe they are and whether they are exploited in the wild.
Newest vulnerabilities
- CVE-2026-100397: Rucio unauthenticated administrator impersonation in SSH challenge tokenscriticalCVSS 9.8
- CVE-2026-93335: HashiCorp Vault ACL policy deny bypass via trailing slashmediumCVSS 6.5
- CVE-2026-93333: Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce…lowCVSS 2.7
- CVE-2026-92735: HashiCorp Vault credential disclosure in integrated storage joinmediumCVSS 5.9
- CVE-2026-128067: Pillow heap buffer overflow in TIFF encoder with mismatched geometry tagshigh
- CVE-2026-128066: Pillow memory denial of service in TIFF and EXIF parsingmedium
- CVE-2026-128065: grpc-js-xds RBAC override policy bypassmedium
- CVE-2026-127275: Linksys EA8100 authentication bypass in JNAP APIcriticalCVSS 10
- CVE-2026-127274: A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file…lowCVSS 3.7
- CVE-2026-127273: Linksys EA8100 missing authentication in JNAP APImediumCVSS 4.3
- CVE-2026-127212: Dokploy missing ownership check in application monitoringmediumCVSS 4.3
- CVE-2026-126982: MongoDB C# Driver BSON type allow-list bypasshighCVSS 7.5
- CVE-2026-126839: MongoDB BSON deserialization type-restriction bypassmediumCVSS 4.2
- CVE-2026-126792: libmongocrypt out-of-bounds write in key-management request buildermediumCVSS 4.7
- CVE-2026-126367: @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and…mediumCVSS 4.8
- CVE-2026-126366: msgpack-ruby JRuby decoder uncapped memory allocation on malformed headershighCVSS 7.5
- CVE-2026-126365: Astro Prism and Markdoc XSS via unsupported languagemediumCVSS 5.4
- CVE-2026-126364: Astro case-sensitive path bypass in image endpointinfo
- CVE-2026-126363: Astro @astrojs/solid-js HTML injection in slot nameslow
- CVE-2026-126362: Astro @astrojs/svelte renderer HTML injection via unescaped slot nameslow
- CVE-2026-126361: Astro HTML injection in dynamic element renderinginfo
- CVE-2026-126360: OpenTelemetry Python ReDoS in traceparent parsingmediumCVSS 5.3
- CVE-2026-126359: Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML…lowCVSS 3.4
- CVE-2026-126358: Hono RegExpRouter middleware bypass via wildcard matchingmediumCVSS 5.3
- CVE-2026-126357: Hono mount() path traversal bypasses middleware scopingmediumCVSS 5.3
- CVE-2026-126356: Hono validator form multipart/form-data parameter bypassmediumCVSS 5.3
- CVE-2026-126355: Hono csrf() middleware bypass via hyperlink auditingmediumCVSS 5.3
- CVE-2026-120868: Citrix NetScaler ADC memory overflow in packet processinginfo
- CVE-2026-91141: COVESA vsomeip memory exhaustion in TCP endpoint bufferinfo
- CVE-2026-127211: MultiVendorX broken access control in stores REST routemediumCVSS 6.5
Critical or exploited, last 30 days
- CVE-2026-100397: Rucio unauthenticated administrator impersonation in SSH challenge tokenscriticalCVSS 9.8
- CVE-2026-127275: Linksys EA8100 authentication bypass in JNAP APIcriticalCVSS 10
- CVE-2026-68548: Algernon URL-prefix authorization bypass on case-insensitive filesystemscriticalCVSS 9.4
- CVE-2026-124014: Copeland XWEB EVO arbitrary file writecriticalCVSS 9.1
- CVE-2026-124010: Copeland XWEB EVO command injection vulnerabilitycriticalCVSS 9.8
- CVE-2026-124004: Copeland XWEB EVO hardcoded backdoor authentication bypasscriticalCVSS 9.8
- CVE-2026-124002: Copeland XWEB EVO pre-authentication OS command injectioncriticalCVSS 9.8
- CVE-2026-107360: rubygem-safemode Jail allow-list bypass in compound assignmentcriticalCVSS 9.6
- CVE-2026-19422: Zohocorp ManageEngine DDI Central authentication bypass in Windows agent APIscriticalCVSS 9.1
- CVE-2026-12591: Zoho ManageEngine M365 Manager Plus privilege escalation to RCEcriticalCVSS 9.9
- CVE-2026-12507: Zohocorp ManageEngine remote code execution in Reports modulecriticalCVSS 9.1
- CVE-2026-76954: Synology DiskStation Manager SQL injection in Auth APIcriticalCVSS 9.8
- CVE-2026-67449: Portabase path traversal in TUS upload webhook handlercriticalCVSS 9.8
- CVE-2026-126263: Fortinet FortiMail SQL injectioncriticalCVSS 9.8
- CVE-2026-126262: Fortinet FortiAnalyzer and FortiManager SQL injection in OFTPcriticalCVSS 9.8
- CVE-2026-126259: Fortinet FortiOS authentication bypass in HA command executioncriticalCVSS 9.8
- CVE-2026-126257: Fortinet FortiAuthenticator hard-coded password authentication bypasscriticalCVSS 9
- CVE-2026-126254: Fortinet FortiOS numeric truncation error in BGP daemoncriticalCVSS 9.6
- CVE-2026-126253: Fortinet FortiOS authentication bypass in OSPF daemoncriticalCVSS 9.3
- CVE-2026-126251: Fortinet FortiAuthenticator incorrect authorizationcriticalCVSS 9.1